CVE-2025-37984
crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP()
Reported by linux · Published May 20, 2025
In the Linux kernel, the following vulnerability has been resolved: crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() Herbert notes that DIV_ROUND_UP() may overflow unnecessarily if an ecdsa implementation's ->key_size() callback returns an unusually large value. Herbert instead suggests (for a division by 8): X / 8 + !!(X & 7) Based on this formula, introduce a generic DIV_ROUND_UP_POW2() macro and use it in lieu of DIV_ROUND_UP() for ->key_size() return values. Additionally, use the macro in ecc_digits_from_bytes(), whose "nbytes" parameter is a ->key_size() return value in some instances, or a user-specified ASN.1 length in the case of ecdsa_get_signature_rs().
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| kernel6.12-modules-extra | Amazon Linux | 1:6.12.40-63.114.amzn2023 |
| kernel6.12-tools | Amazon Linux | 1:6.12.40-63.114.amzn2023 |
| python3-perf6.12 | Amazon Linux | 1:6.12.40-63.114.amzn2023 |
| bpftool6.12 | Amazon Linux | 1:6.12.40-63.114.amzn2023 |
| kernel6.12-devel | Amazon Linux | 1:6.12.40-63.114.amzn2023 |
| Linux | Linux | f2133b849ff273abddb6da622daddd8f6f6fa448, f02f0218be412cff1c844addf58e002071be298b, b16510a530d1e6ab9683f04f8fb34f2e0f538275, 921b8167f10708e38080f84e195cdc68a7a561f1, 6.6.99 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | 55779f26eab9af12474a447001bd17070f055712, c6ab5c915da460c0397960af3c308386c3f3247b, c6ab5c915da460c0397960af3c308386c3f3247b |
| Linux | Linux | 6.10, 0, 6.6.99 |
| amazon:2023 | kernel6.12-modules-extra | 0 |
| amazon:2023 | kernel6.12-tools | 0 |
| amazon:2023 | python3-perf6.12 | 0 |
| amazon:2023 | bpftool6.12 | 0 |
| amazon:2023 | kernel6.12-devel | 0 |
| Linux | Linux | 6.6.70, 55779f26eab9af12474a447001bd17070f055712, 6.10 |
| amazon:2023 | perf6.12 | 0 |
| amazon:2023 | kernel6.12-libbpf-static | 0 |
| amazon:2023 | kernel6.12-libbpf-devel | 0 |
| amazon:2023 | kernel6.12-libbpf | 0 |
| amazon:2023 | kernel6.12 | 0 |
| amazon:2023 | kernel6.12-tools-devel | 0 |
| amazon:2023 | kernel-livepatch-6.12.40-63.114 | 0 |
| linux | linux_kernel | 6.10, 6.10, 6.6.70 |
| amazon:2023 | kernel6.12-headers | 0 |
| amazon:2023 | kernel6.12-modules-extra-common | 0 |
Timeline
- May 20, 2025 CVE Published
- May 21, 2025 EPSS Score (30 in total, the first dated here)
- Jun 1, 2025 Coalition ESS Score (13 in total, the first dated here)
- Oct 12, 2025 PoC Published (7 in total, the first dated here)
- Dec 15, 2025 Security Advisory (230 in total, the first dated here)
- Mar 29, 2026 Distribution Patch (221 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2025-37984
vulnetix vdb fixes CVE-2025-37984Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-37984/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart